1. Field
This disclosure relates to secured communications.
2. Description of the Related Art
Traditionally, identity of an entity has been defined through one or more absolute labels or collections of properties of the entity. An entity is something that has objective or physical reality and distinctness of being and character. An entity has independent or separate existence from other like entities, and has a unitary and self-contained character. An entity may be a human, an animate or inanimate object, a machine or a process, and may be just one of these or a group of like or unlike entities.
Identity of an entity is typically defined in terms of a) what the entity possesses, b) what the entity knows, and c) what the entity is. Any one who can steal or possess these attributes can for all practical purposes assume the identity of the original entity. Identity can be defined by persistent qualities (e.g., a human fingerprint) and by transitory qualities (e.g., a human's current location).
Absolute and relative identity principles may be used to define an entity's identity. An individual's identity is absolute if it is defined independently of all other like entities. For example, a human's absolute identity may be defined by their name, their social security number, or their passport number. In contrast, an entity's is relative if it is defined based upon the entity's relationship with some other individual or individuals. For example, a human's relative identity may be defined by their relationship as father or mother of a particular other person, as an employee of a particular company, or a friend of some other person. As can be seen, one or more aspects of an individual's identity may or may not be unique.
An entity's interaction with other entities is based on mutual trust which is specific to that particular relationship. Historically, authentication between two individuals meant that the two individuals knew each others identity based on a previously established trust. As a result of the established trust, these two individuals would allow each other to send and receive information between each other.
While effective communications are based upon trust, modern digital communications have faced problems with identity theft. Identity theft as originally limited to theft of individuals' identities. However organizations, such as financial organizations, government agencies, military infrastructures, hospitals and educational institutions, are now also seeing their identities misappropriated.
Digital identity theft can happen surreptitiously under the stealthiest of circumstances. Organized identity theft can peel off layer after layer of the trusted identities of a typical computing environment and surroundings without the slightest warning or suspicion. With more personal data being stored electronically, many safeguards have been implemented or proposed. Yet, while these defenses have cut down on some types of fraud, they generally do nothing or fail effectively to protect against identity theft.
Advanced security solutions such as public keys, digital certificates and centralized certificate authorities have been used to provide environments of trusted identity. There have been systematic evolutionary changes in identity management over the years, through the discovery of cryptography, Shannon's theorem on perfect secrecy, the RSA algorithm, firewalls, intrusion detection systems, VPNs, CAs, the Public Key Infrastructure and the use of biometrics, amongst other things. There have also been efforts to expose the serious weaknesses of the current security infrastructure solutions by Dick Hardt of Sxip, Kim Cameron of Microsoft, Bob Blakely of IBM and Kaliya Hamlin. They proposed user centric approaches as opposed to the currently practiced certificate authority centric approaches.